Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97572— bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： bnxt_en：在 bnxt_init_nic() 中传播 RX 环初始化失败错误 当 失败时， 会返回错误，但 忽略了该返回值，并继续调用 ，从而启用 TPA（接收聚合）。 如果内存分配失败，可能导致 数组部分被清零，而 TPA 仍会在一个条目全部为零的数组上被启用。这可能导致如果 被映射到某个已被清零的入口对应的软件索引，则会分配出一个 DMA 地址为零的错误地址。 修复方法是将错误从 向上层调用者传播。目前两个调用者均已检查其返回值，并在发生错误时通过 和 进行清理和

AI Predicted 5.5 Difficulty: Moderate EPSS 0.21% · P10

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c0c050c58d840994ba842ad1c338a98e7c12b764< e40641638743b4b848d5ed78a0565afffc359d8e affected
c0c050c58d840994ba842ad1c338a98e7c12b764< 6b24eca42619b93f69aebc2aa0a9fd28ac9a5085 affected
c0c050c58d840994ba842ad1c338a98e7c12b764< 1f2d333ae2e1a73b7cc1c2a627587024cd147c01 affected
c0c050c58d840994ba842ad1c338a98e7c12b764< c3eb07e78e628243cbb9bbb0115db802fb7a303f affected
c0c050c58d840994ba842ad1c338a98e7c12b764< daadccd062fdca5e77a8cc22ffe35857803b6c49 affected
c0c050c58d840994ba842ad1c338a98e7c12b764< b4c40f2c80d7bf50648878bc206a39adfbfaec6c affected
c0c050c58d840994ba842ad1c338a98e7c12b764< dfd73af81cdb9f7b399754a59e2658a08211bee5 affected
c0c050c58d840994ba842ad1c338a98e7c12b764< 8e6a850c0746bb4be167aedf1ee57469fcda09a9 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97572

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_init_rx_rings() returns an error when bnxt_alloc_one_rx_ring() fails, but bnxt_init_nic() discards that return value and calls bnxt_init_chip(), which enables TPA. If an allocation fails, this could leave rxr->rx_tpa[] partially zeroed and TPA would be enabled over an array with zeroed entries. This would lead to a zeroed DMA address being handed out if the agg_idx is translated to a SW index at a zeroed entry. Fix this by propagating the error out of bnxt_init_nic(). Both callers already check its return value and unwind with bnxt_free_skbs() and bnxt_free_mem(), which tolerate a partially initialized RX ring.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c0c050c58d840994ba842ad1c338a98e7c12b764 ~ e40641638743b4b848d5ed78a0565afffc359d8e -
Linux Linux 4.4 -

II. Public POCs for CVE-2026-97572

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97572

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97572 (8)

Same Patch Batch · Linux · 2026-09-25 · 372 CVEs total

CVE-2026-100075 9.8 CRITICAL RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CVE-2026-97957 8.8 HIGH net: hinic: fix mailbox segment buffer overflow
CVE-2026-97527 8.8 HIGH scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
CVE-2026-97528 8.8 HIGH scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
CVE-2026-97555 8.8 HIGH smb: client: fix heap overflow in DACL owner/group rewrite
CVE-2026-98115 8.8 HIGH ksmbd: safely drain sessions during logoff
CVE-2026-97525 8.2 HIGH x86/mm/pat: Allocate split page tables as kernel page tables
CVE-2026-97573 8.1 HIGH bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
CVE-2026-97570 8.1 HIGH bnxt_en: Bound SW TPA IDs to prevent crashes
CVE-2026-98070 8.1 HIGH net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
CVE-2026-98069 8.1 HIGH net/rds: acquire the fastpath locks in rds_conn_shutdown()
CVE-2026-98130 8.1 HIGH sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
CVE-2026-98116 7.8 HIGH ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
CVE-2026-97903 7.8 HIGH exit: hold a reference to thread_pid across proc_flush_pid
CVE-2026-97548 7.8 HIGH xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
CVE-2026-97611 7.8 HIGH net: openvswitch: fix use-after-free of the flow table mask array
CVE-2026-97612 7.8 HIGH net: mpls: clear inner_protocol when the last label is popped
CVE-2026-98073 7.8 HIGH net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
CVE-2026-97602 7.8 HIGH inet: frags: invalidate queues before flushing them
CVE-2026-97577 7.8 HIGH media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

Showing top 20 of 372 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-97572

No comments yet

Leave a comment